Best/Simple hardware security token authentication for ASP.NET websites?

Question

Hi.

I was recently asked to provide a quote on integrating a security solution like most Online Banks use, where there is a security token which key/numbers are randomly changing.

The portal is an ASP.NET website, 2.0...

I haven't implemented this type of security authentication before. Can anyone provide guidance, suggestions, experiences, etc, about the components/hardware they've worked with?

Thanks

Answer 1

The most secure way of doing it with a physical token is actually to use a third party product such as RSA SecurId. They also have a version for sending the token to a mobile device which is part of their "On-demand Authenticators" offering.

Otherwise if you want to manufacture your own system then you need to consider:

• The lifetime of the token.
  • What length of time does the token need to be active for?
  • What happens if the client is in a different timezone than the server?
• The randomness of the token?
  • What method are you using to generate the token? Last n digits of GUID? Psuedo Random number table? secret + userID + random number, hashed and then take last n digits?
  • What are the valid characters for a token? [0-9]* | [a-zA-Z]* | [0-9A-F]* | etc.
  • What is the length of the token?
• Where is the token stored before it is validated?
• How secure is the mechanism used to transport the token?
  • Over HTTPS?
  • Over public SMS network?
• How does the user receive the token?
  • Rabo bank have a device which you unlock with a pin and then a code is issued.
  • Could have a device that you enter the given token and it issues the token you need to respond with?
• What happens if an expired token is presented?
• How many tries to you give them before you lock the device/access?

I was involved with putting a system together for a bank. It was implemented using a mechanism similiar to that offered by the Microsoft Federation Gateway. It might not have been for a Login but it was still used for Authentication.